• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.1159-1162
• /
• 2002

네트워크 기반의 IDS(Intrusion Detection System)가 개발된 이후 네트워크 패킷 정보를 분석하여 침입을 탐지하는 방법들이 연구되고 있다. 그러나 네트워크의 규모가 커지면서 NIDS 에서 발생하는 이벤트의 양이 증가하고 거짓 이벤트의 양도 따라 증가함으로써 이를 분석하는데 어려움이 있다. 본 논문은 많은 이벤트로부터 보다 위험성 있는 공격을 탐지하는 방법을 제시하고, 이를 현재 사용되고 있는 NIDS인 snort에 확장시켜 구현 하였다. 본 시스템은 침입자의 의도파악을 위하여 스캔과 같은 기본적인 이벤트를 관리한다. 또한 새로운 취약점에 대한 공격에 우선순위를 두어 오래된 공격방법보다 최근의 공격방법에 더 높은 우선순위를 부여한다. 전체 request 에서 공격이라 판단되는 request의 비율로써 사용자가 공격의도가 있는지를 파악한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.9 no.1
• /
• pp.57-70
• /
• 1999

Since a hybrid firewall filters packets at a network layer along with providing gateway functionalities at an application layer, it has a better performance than an If filtering firewall. In addition, it provides both the various kinds of access control mechanisms and transparent services to users. However, the security policies of a network layer are different from those of an application layer. Thus, the user interfaces for managing a hybrid firewalls in a consistent manner are needed. In this paper, we implement a graphical user interface to provide access control mechanisms and management facilities for a hybrid firewall such as log analysis, a real-time monitor for network traffics, and the statisics on traffics. And we also propose a new rule script language for specifying access control rules. By using the script language, users can generate the various forma of access control rules which are adapted by the existing firewalls.

• The KIPS Transactions:PartC
• /
• v.16C no.2
• /
• pp.151-164
• /
• 2009

The importance of sensor networks as a base of ubiquitous computing realization is being highlighted, and espicially the security is recognized as an important research isuue, because of their characteristics.Several efforts are underway to provide security services in sensor networks, but most of them are preventive approaches based on cryptography. However, sensor nodes are extremely vulnerable to capture or key compromise. To ensure the security of the network, it is critical to develop security Intrusion Detection System (IDS) that can survive malicious attacks from "insiders" who have access to keying materials or the full control of some nodes, taking their charateristics into consideration. In this perper, we design a distributed and adaptive IDS architecture on sensor networks, respecting both of energy efficiency and IDS efficiency. Utilizing a modified HEED algorithm, a clustering algorithm, distributed IDS nodes (dIDS) are selected according to node's residual energy and degree. Then the monitoring results of dIDSswith detection codes are transferred to dIDSs in next round, in order to perform consecutive and integrated IDS process and urgent report are sent through high priority messages. With the simulation we show that the superiorities of our architecture in the the efficiency, overhead, and detection capability view, in comparison with a recent existent research, adaptive IDS.

• Korean Security Journal
• /
• no.22
• /
• pp.15-35
• /
• 2010

A larceny means stealing others' properties, as one of crime types most closely connected with common people. Along with fraud, it is the mostly common property crime; in particular, the largest number of people are exposed to a burglary. This study aims to find the schemes to utilize private guards according to the characteristics of burglary. To do so, a questionnaire survey was conducted into an actual condition of official statistics of burglary and into the criminals of burglary, with a view to understanding the behavioral characteristics of burglary and suggesting defense mechanisms to prevent the crime. Burglary is not just a major crime to be dealt with by public guards like the police but also one to be handled increasingly more by private guards. It is why this study intends to identify how to utilize private guards in preventing the crime. Investigations were made into 208 burglars, who were inmates of 10 correctional institutions (prisons or detention houses) across the country. It is found that only about 24% of burglars committed the crime through rational choice, about 60.7% were feared of their arrest at the time of their crime, and a very high percentage (69.9%) of them were assured of their successful crime. Burglaries usually happened at night, mostly in a summer day when everybody goes away from home for vacation. Primarily, the crimes took place in a private house of urban residential quarters. What burglars considered mostly for target selection includes 'profitability,' followed by 'surveillance' and 'risk.' Most (42%) of them committed the crime for the first time ever. Generally, they were not inclined to commit the crime while under the influence of alcohol or drug, which might prevent them from making reasonable decisions. 73.9% of the criminals said that they committed the crime singly without any accomplices.

• Journal of the Korea Society of Computer and Information
• /
• v.13 no.1
• /
• pp.143-151
• /
• 2008

Execute IP traceback at this paper as target an intruder's attacking that Bypass Attack in order to avoid an exposure of own Real IP address Design IP traceback server and agent module, and install in Internet network system for Real IP traceback. Set up detection and chase range aggressive loop around connection arbitrariness, and attack in practice, and generate Real IP data cut off by fatal attacks after data and intrusion detection accessed general IP, and store to DB. Generate the Forensic data which Real IP confirms substance by Whois service, and ensured integrity and the reliability that buy to early legal proof data, and was devoted to of an invader Present the cyber criminal preventive effect that is dysfunction of Ubiquitous Information Society and an effective Real IP traceback system, and ensure a Forensic data generation basis regarding a judge's robe penalty through this paper study.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.37-45
• /
• 2023

Cyber deception technology plays a crucial role in monitoring attacker activities and detecting new types of attacks. However, along with the advancements in deception technology, the development of Anti-honeypot technology has allowed attackers who recognize the deceptive environment to either cease their activities or exploit the environment in reverse. Currently, deception technology is unable to identify or respond to such situations. In this study, we propose a predictive model using Markov chain analysis to determine the identification of attackers who infiltrate deceptive environments. The proposed model for deception status determination is the first attempt of its kind and is expected to overcome the limitations of existing deception-based attacker analysis, which does not consider attackers who identify the deceptive environment. The classification model proposed in this study demonstrated a high accuracy rate of 97.5% in identifying and categorizing attackers operating in deceptive environments. By predicting the identification of an attacker's deceptive environment, it is anticipated that this model can provide refined data for numerous studies analyzing deceptive environment intrusions.

• Proceedings of the Membrane Society of Korea Conference
• /
• 1997.10a
• /
• pp.141-142
• /
• 1997

1. 서론 : 중공사막은 제조과정인 wet spinning의 과정에서 defect가 형성될 수 있어 분리선택도에 큰 영향을 미친다. 이러한 defect의 처리방법으로는 dipping method등의 방법이 현재 널리 쓰이고 있다. dipping method는 제조된 중공사막을 PDMS등의 고분자 용액 속으로 통과시켜 결과적으로 중공사막 표면에 얇은 고분자막이 형성되도록 하는 방법이다. 그러나 이러한 방법으로 중공사막을 처리할 경우 고분자 용액이 pore내로 침입하거나 중력으로 인하여 용액의 아래쪽으로 몰려 하반부의 두께가 두꺼워진다는 단점이 있다.(생략)

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.367-369
• /
• 2004

허니팟은 공격자들이 쉽게 공격할 수 있는 시스템이나 네트워크를 구성하여, 악성해커나 스크립트 키드들이 어떻게 시스템을 침입하고 공격하는지 감시할 수 있도록 구성되어 있는 시스템을 말한다. 일반적으로 허니팟은 방화벽과 로그 기록 등으로 감사기능을 수행하는데, 악성해커는 그 로그마저 복구할 수 없도록 삭제하는 경우도 있기 때문에 독립적인 추적 시스템이 필요하다. 본 논문에서는 LKM(Linux Kernel Module)기법을 이용한 키로거를 통해 공격자가 세션 상에서 입력하는 모든 키보드 내용을 기록하여 공격자의 행동을 쉽고 빠르게 분석하는 원격 키스트로크 모니터링 시스템을 설계해 보았다.

• Journal of Sensor Science and Technology
• /
• v.11 no.5
• /
• pp.273-278
• /
• 2002

An intrusion-sensitive capability of multimode graded-index (GRIN) optical fibers under bending has been investigated. In this system, the data light is transmitted in the fundamental mode while alarm monitor light is launched in a high-order mode at the same time. An attempted intrusion to drain data by bending the fiber results in greater attenuation of a monitor signal in higher order modes, thereby setting off an alarm at the receiver. Light propagation in a multimode graded-index fiber is also analyzed theoretically when the fundamental mode is selectively excited and the fiber is bent around a constant radius mandrel. The bending generates coupling between the various modes of the fiber. Power transitions of the fundamental mode by changing the bending radius were also analyzed numerically using program simulation. It is shown that Asawa-Taylor model[4] is valid up to 1cm of the radius of curvature of the fiber bend.

• Journal of KIISE:Software and Applications
• /
• v.34 no.6
• /
• pp.519-529
• /
• 2007

In this paper, we investigate the use of fuzzy rules for efficient intrusion detection. We use evolutionary algorithm to optimize the set of fuzzy rules for intrusion detection by constructing fuzzy decision trees. For efficient execution of evolutionary algorithm we use supervised clustering to generate an initial set of membership functions for fuzzy rules. In our method both performance and complexity of fuzzy rules (or fuzzy decision trees) are taken into account in fitness evaluation. We also use evaluation with data partition, membership degree caching and zero-pruning to reduce time for construction and evaluation of fuzzy decision trees. For performance evaluation, we experimented with our method over the intrusion detection data of KDD'99 Cup, and confirmed that our method outperformed the existing methods. Compared with the KDD'99 Cup winner, the accuracy was increased by 1.54% while the cost was reduced by 20.8%.